The present invention concerns a computer architecture that allows secure access to a server behind a firewall and in particular to a system that employs multiple computers outside of the firewall and a password scheme that includes a one-time password and has biometric features.
As computer hacking is quite common nowadays, it is very important to control access to a private network of computers (for example, the desktop computers in a company network)—to order to protect against the loss of sensitive data to external hackers. A firewall is a component or components designed to restrict access to a private network from the Internet.
There has been recently considerable interest to use biometrics features for authentication of computer users who communicate through a global information network such as the Internet as well as local area networks (see e.g., R. Jain et al. “Biometrics: Personal Identification in Networked Society” Kluwer Publishers, Boston, Mass., 1999). The biometrics features of an individual are unique and provide a very convenient method for personal identification. The term biometrics generally means any human characteristic that has the following desirable properties:                universality—every person should have the characteristic        uniqueness—no two persons should possess the same characteristic        permanence—the characteristic should not change with time        measurability—it should be possible to measure the characteristic in a quantitative manner.        
There are many practical issues involved in developing an authentication scheme using biometrics. Some good pattern recognition algorithms should be developed and used to recognize the biometrics to a very high degree of accuracy (even under “noisy” conditions) and to within a reasonable computer processing time. Also, the biometrics should not be prone to easy tampering by hackers. There are also privacy and network security issues that are involved for developing an on-line biometrics-based authentication system.
The features that have been commonly used in developing automatic authentication systems are fingerprints, voice, iris, retina patterns, and face. Also, there are some other more unconventional biometrics such as body odors, gait, ear shape, etc. that have been used for developing methods for personal identification. There are several currently available systems for on-line fingerprint verification and on-line signature verification. A secure method for accessing files using fingerprints has been is described in copending U.S. patent application Ser. No. 09/662,298 entitled SECURE SYSTEM AND METHOD FOR ACCESSING FILES IN COMPUTERS USING FINGERPRINTS, which is incorporated herein by reference.
The use of fingerprints is the oldest biometrics-based method for identification purposes, predating the advent of computer technology. The technique has been widely used at least since 6000 B.C. It has been in use by police forces for centuries for the identification of criminals. Consequently, in some cultures there may be still some stigma attached to the recording of fingerprints of people who are not accused of any crime. Nonetheless, fingerprints are widely used. For example, the U.S. Immigration and Naturalization Services (INS) routinely collects the fingerprints of all people applying for Permanent Residence (“Green Card”) and keeps an extensive database of these fingerprints. With the introduction of more and more computer hardware, the identification method using fingerprints has become progressively more and more advanced and easier to use in an on-line environment. More recent biometric-based methods of identification, such as iris pattern recognition, retinal pattern recognition, voice recognition, etc., have similarly benefited from the advancing use of computers.
The idea of one time password mechanism is described in an article by L. Lamport entitled “Password Authentication with Insecure Communications,” Communications of the ACM, vol. 24, No. 11, pp 770–772, 1981. It is designed to counter an attack based on eavesdropping of network connections to get login id and password. In order to use one time password mechanism the user first chooses a password and stores it in the authentication server. The server chooses a number n (something reasonably large) and recursively hashes the password n times (i.e. computes hashn(password) for some hash function) and stores the result in a database on the server along with the user id and the number n. The number n represents the number of one time password the user can use i.e., the number of log-in sessions the user can have with this password mechanism scheme. With each use the hash function is applied one less time, creating a respectively different password. If the user exceeds the n number of log-in sessions then, he or she needs to initialize again the one time password mechanism with the server.
One version of the one-time password scheme is called S/KEY and is described in RFC 1760 by N. Haller entitled “The S/Key One-Time Password System,” 1995. Briefly, a one-time password mechanism operates as shown in FIG. 1.
The one-time password process begins with a table in the remote machine (authentication server) 102 that contains the log-in identifier, the number n and the value hashn(password). Next, a user logs into his or her local computer 100 using the password and log-in identifier and requests access to the remote server 102. The user's computer then sends an authentication request to the remote machine 102. After receiving the authentication request, the remote server 102 sends the value n with a request for the user's computer 100 to calculate the value hashn−1(password). The user's computer 100 calculates this value and sends it back to the remote server 102. When the remote server 102 receives hashn−1(password) it assigns the value to a local variable y and then calculates hash(y). This value should be the same as hashn(password). If hash(y) matches the stored value, hashn(password), then the server grants the user access, decrements n by 1 and stores the value hashn−1(password) in its database.